m2.nz/content/posts/nginx_geo_block.md

title	tags	date
Geo Blocking countries with nginx	spam geo block nginx	2024-04-07

Quick and easy way to block entire countries using simple nginx rules. Note this is primarily for Ubuntu/Nginx but may work on other systems

Install required fields

apt install -y libnginx-mod-http-geoip geoip-database

The GeoIP DB will be under /usr/shared/GeoIP/GeoIPv6.dat (Or GeoIP.dat for v4 only) We need to add this into nginx conf:

echo 'geoip_country /usr/share/GeoIP/GeoIP.dat;' > /etc/nginx/conf.d/geoip.conf

Add this block under the main "http" block in nginx.conf:

# /etc/nginx/nginx.conf
map $geoip_country_code $allowed_country {
    default yes;
    BD no; # Country code to block - Can list mulitple
}

Then we need to add a simple check in our site vhost:

# /etc/nginx/sites-enabled/your_site.conf
if ($allowed_country = no) {
    return 403;
}

Quick reload and boom! Done!

systemctl reload nginx

Based off an older gist found on Github here